Back to Details

secure

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Security

安全

Security Checklist

安全检查清单

Security Basics:
- [ ] Authentication required for protected routes
- [ ] Passwords hashed (bcrypt/argon2), never stored plain text
- [ ] API keys in environment variables, not code
- [ ] HTTPS only in production
- [ ] Input validated on server side
- [ ] SQL injection prevented (use parameterized queries)
- [ ] XSS prevented (sanitize user input)
- [ ] CSRF tokens on forms
- [ ] Rate limiting on API endpoints
- [ ] User sessions expire (30min-1hr typical)
See COMMON-VULNS.md for detailed checks.
Security Basics:
- [ ] 受保护路由需身份验证
- [ ] 密码已哈希处理（使用bcrypt/argon2），绝不以明文存储
- [ ] API密钥存储在环境变量中，而非代码里
- [ ] 生产环境仅使用HTTPS
- [ ] 服务器端验证输入
- [ ] 防止SQL注入（使用参数化查询）
- [ ] 防止XSS攻击（清理用户输入）
- [ ] 表单添加CSRF令牌
- [ ] API端点设置速率限制
- [ ] 用户会话自动过期（通常为30分钟-1小时）
查看COMMON-VULNS.md获取详细检查项。

Critical: Never Store These in Code

重点注意：切勿在代码中存储以下内容

Move to environment variables:
  • Database passwords
  • API keys (Stripe, SendGrid, etc)
  • JWT secrets
  • OAuth client secrets
  • Encryption keys
Tell AI:
Store API keys in .env file, not in code.
Add .env to .gitignore.
Access via process.env.API_KEY
移至环境变量：
  • 数据库密码
  • API密钥（Stripe、SendGrid等）
  • JWT密钥
  • OAuth客户端密钥
  • 加密密钥
告知AI：
Store API keys in .env file, not in code.
Add .env to .gitignore.
Access via process.env.API_KEY

Authentication Basics

身份验证基础

Minimum requirements:
  • Passwords: 8+ chars, require number/symbol
  • Hash passwords (bcrypt with 10+ rounds)
  • Email verification for signups
  • Password reset via email only
  • Sessions expire (30-60 min idle)
  • Logout clears session completely
Tell AI:
Add authentication:
- bcrypt for password hashing (12 rounds)
- Email verification required
- Session timeout: 30 minutes
- Password requirements: 8+ chars, 1 number, 1 symbol
See SECURITY-PROMPTS.md for implementation details.
最低要求：
  • 密码：至少8个字符，需包含数字/符号
  • 密码哈希处理（bcrypt，至少10轮）
  • 注册需邮箱验证
  • 仅通过邮箱重置密码
  • 会话过期（闲置30-60分钟后）
  • 登出时完全清除会话
告知AI：
Add authentication:
- bcrypt for password hashing (12 rounds)
- Email verification required
- Session timeout: 30 minutes
- Password requirements: 8+ chars, 1 number, 1 symbol
查看SECURITY-PROMPTS.md获取实现细节。

Data Protection

数据保护

Always encrypt:
  • Passwords (hashed, not encrypted)
  • Payment info (use Stripe, don't store cards)
  • Personal identifiable information (PII)
Never log:
  • Passwords (even hashed)
  • Credit card numbers
  • API keys
  • Session tokens
Tell AI:
Never log sensitive data.
Replace passwords/tokens with "[REDACTED]" in logs.
始终加密：
  • 密码（哈希处理，而非加密）
  • 支付信息（使用Stripe，勿存储银行卡信息）
  • 个人可识别信息（PII）
切勿记录：
  • 密码（即使是哈希后的）
  • 信用卡号
  • API密钥
  • 会话令牌
告知AI：
Never log sensitive data.
Replace passwords/tokens with "[REDACTED]" in logs.

API Security

API安全

Required for all API endpoints:
  • Authentication check
  • Rate limiting (prevent abuse)
  • Input validation
  • Error messages don't leak info
Tell AI:
Add to all API routes:
- Require valid auth token
- Rate limit: 100 requests/minute per IP
- Validate all inputs (reject invalid)
- Generic error messages (no stack traces to users)
所有API端点必须满足：
  • 身份验证检查
  • 速率限制（防止滥用）
  • 输入验证
  • 错误信息不泄露敏感内容
告知AI：
Add to all API routes:
- Require valid auth token
- Rate limit: 100 requests/minute per IP
- Validate all inputs (reject invalid)
- Generic error messages (no stack traces to users)

Common Vulnerabilities

常见漏洞

Most common in AI-built apps:
  1. Exposed API keys - In code instead of .env
  2. No rate limiting - APIs can be spammed
  3. Missing auth checks - Routes accessible without login
  4. SQL injection - Raw SQL with user input
  5. XSS attacks - Unescaped user content displayed
See COMMON-VULNS.md for how to check.
AI构建应用中最常见的漏洞：
  1. API密钥暴露 - 存储在代码中而非.env文件
  2. 未设置速率限制 - API可能被垃圾请求攻击
  3. 缺失身份验证检查 - 未登录即可访问路由
  4. SQL注入 - 使用包含用户输入的原始SQL语句
  5. XSS攻击 - 显示未转义的用户内容
查看COMMON-VULNS.md了解检查方法。

Security Prompts for AI

AI安全提示词

Adding authentication:
Add authentication to this route.
Require valid JWT token.
Return 401 if missing/invalid.
Don't expose error details.
Rate limiting:
Add rate limiting:
- 100 requests/minute per IP
- Return 429 "Too many requests" if exceeded
- Use sliding window, not fixed
Input validation:
Validate all user inputs:
- Email: valid format
- Password: 8+ chars, 1 number, 1 symbol
- Username: alphanumeric only, 3-20 chars
Reject invalid input with clear error message
See SECURITY-PROMPTS.md for more.
添加身份验证：
Add authentication to this route.
Require valid JWT token.
Return 401 if missing/invalid.
Don't expose error details.
速率限制：
Add rate limiting:
- 100 requests/minute per IP
- Return 429 "Too many requests" if exceeded
- Use sliding window, not fixed
输入验证：
Validate all user inputs:
- Email: valid format
- Password: 8+ chars, 1 number, 1 symbol
- Username: alphanumeric only, 3-20 chars
Reject invalid input with clear error message
查看SECURITY-PROMPTS.md获取更多内容。

Pre-Launch Security Review

上线前安全审查

Before deploying:
Production Security:
- [ ] All secrets in environment variables
- [ ] HTTPS enforced (no HTTP)
- [ ] Database backups configured
- [ ] Rate limiting on all APIs
- [ ] Error pages don't show stack traces
- [ ] Admin routes protected
- [ ] File uploads validated (type, size)
- [ ] CORS configured (not wildcard "*")
部署前需完成：
Production Security:
- [ ] 所有密钥存储在环境变量中
- [ ] 强制使用HTTPS（禁止HTTP）
- [ ] 配置数据库备份
- [ ] 所有API设置速率限制
- [ ] 错误页面不显示堆栈跟踪
- [ ] 管理路由受保护
- [ ] 文件上传已验证（类型、大小）
- [ ] 配置CORS（不使用通配符"*"）

When to Get Security Audit

何时需要进行安全审计

Signs you need expert review:
  • Handling payments directly (not Stripe)
  • Storing health/financial data
  • Multi-tenant with data isolation
  • Over 1,000 users
  • Processing sensitive PII
For most MVPs: Following this checklist is sufficient.
需要专家审查的迹象：
  • 直接处理支付（而非使用Stripe）
  • 存储健康/财务数据
  • 多租户架构且需数据隔离
  • 用户量超过1000人
  • 处理敏感PII数据
对于大多数MVP： 遵循本检查清单已足够。

Common Founder Mistakes

创始人常见错误

MistakeFix
API keys in codeMove to .env
No rate limitingAdd to all endpoints
Plain text passwordsUse bcrypt
HTTP in productionForce HTTPS
Accepting all CORSWhitelist domains
No input validationValidate server-side
Detailed error messagesGeneric messages only
错误修复方案
API密钥在代码中移至.env文件
未设置速率限制为所有端点添加速率限制
明文密码使用bcrypt
生产环境使用HTTP强制使用HTTPS
接受所有CORS请求白名单允许的域名
未验证输入服务器端验证输入
详细错误信息仅使用通用错误信息

Quick Wins

快速优化项

Easy security improvements:
  1. Add Helmet.js (Node) - Sets security headers
  2. Use HTTPS everywhere - Force in production
  3. Add rate limiting - Prevents abuse
  4. Environment variables - Keep secrets safe
  5. Update dependencies - Fix known vulnerabilities
Tell AI:
Add helmet.js for security headers.
Configure for production (HTTPS, CSP, XSS protection).
简单的安全改进：
  1. 添加Helmet.js（Node）- 设置安全头
  2. 全程使用HTTPS - 生产环境强制启用
  3. 添加速率限制 - 防止滥用
  4. 环境变量 - 安全存储密钥
  5. 更新依赖项 - 修复已知漏洞
告知AI：
Add helmet.js for security headers.
Configure for production (HTTPS, CSP, XSS protection).

Testing Security

安全测试

Quick checks:
Exposed secrets:
bash
grep -r "api_key" src/
grep -r "password" src/
快速检查：
暴露的密钥：
bash
grep -r "api_key" src/
grep -r "password" src/

Should only find references to env vars

应仅找到对环境变量的引用


**No auth bypass:**
- Try accessing protected routes without login
- Should redirect to login or return 401

**Rate limiting works:**
- Hit API endpoint 100 times quickly
- Should get 429 error

---

**身份验证无法绕过：**
- 尝试未登录访问受保护路由
- 应重定向至登录页或返回401

**速率限制生效：**
- 快速调用API端点100次
- 应返回429错误

---

Success Looks Like

成功标准

✅ No secrets in code (all in .env)
✅ Can't access protected routes without auth
✅ Passwords hashed, never stored plain text
✅ Rate limiting prevents abuse
✅ HTTPS enforced in production
✅ Input validated on server side
✅ 代码中无密钥（全部存储在.env中）
✅ 未登录无法访问受保护路由
✅ 密码已哈希处理，绝不以明文存储
✅ 速率限制可防止滥用
✅ 生产环境强制使用HTTPS
✅ 服务器端验证输入